Node.js up to 10.23.x/12.20.x/14.15.x/15.9.x File Descriptor Limit resource consumption

Summaryinfo

A vulnerability classified as problematic has been found in Node.js up to 10.23.x/12.20.x/14.15.x/15.9.x. This affects an unknown part of the component File Descriptor Limit Handler. The manipulation leads to resource consumption. This vulnerability is referenced as CVE-2021-22883. No exploit is available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Node.js up to 10.23.x/12.20.x/14.15.x/15.9.x (JavaScript Library) and classified as problematic. This issue affects some unknown processing of the component File Descriptor Limit Handler. The manipulation with an unknown input leads to a resource consumption vulnerability. Using CWE to declare the problem leads to CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. Impacted is availability.

The weakness was published 03/04/2021. The advisory is shared at hackerone.com. The identification of this vulnerability is CVE-2021-22883. Neither technical details nor an exploit are publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 216256 (Oracle Linux 8 : nodejs:20 (ELSA-2025-1351)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 10.24.0, 12.21.0, 14.16.0 or 15.10.0 eliminates this vulnerability. The upgrade is hosted for download at nodejs.org.

The vulnerability is also documented in the vulnerability database at Tenable (216256). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• JavaScript Library

Name

• Node.js

Version

• 10.0
• 10.1
• 10.2
• 10.3
• 10.4
• 10.5
• 10.6
• 10.7
• 10.8
• 10.9
• 10.10
• 10.11
• 10.12
• 10.13
• 10.14
• 10.15
• 10.16
• 10.17
• 10.18
• 10.19
• 10.20
• 10.21
• 10.22
• 10.23
• 12.0
• 12.1
• 12.2
• 12.3
• 12.4
• 12.5
• 12.6
• 12.7
• 12.8
• 12.9
• 12.10
• 12.11
• 12.12
• 12.13
• 12.14
• 12.15
• 12.16
• 12.17
• 12.18
• 12.19
• 12.20
• 14.0
• 14.1
• 14.2
• 14.3
• 14.4
• 14.5
• 14.6
• 14.7
• 14.8
• 14.9
• 14.10
• 14.11
• 14.12
• 14.13
• 14.14
• 14.15
• 15.0
• 15.1
• 15.2
• 15.3
• 15.4
• 15.5
• 15.6
• 15.7
• 15.8
• 15.9

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion